@aroha-sdk/credentials 1.0.0 → 1.2.0

package/dist/rbac.test.js

@@ -0,0 +1,97 @@
+import { describe, it, expect } from "vitest";
+import { checkPermission, actionForMessageType } from "./rbac.js";
+import { ArohaRole } from "./types.js";
+describe("actionForMessageType", () => {
+    it("maps ArohaRequest to query", () => {
+        expect(actionForMessageType("ArohaRequest")).toBe("query");
+    });
+    it("maps ArohaReserve to reserve", () => {
+        expect(actionForMessageType("ArohaReserve")).toBe("reserve");
+    });
+    it("maps ArohaCommit to commit", () => {
+        expect(actionForMessageType("ArohaCommit")).toBe("commit");
+    });
+    it("maps ArohaCancel to cancel", () => {
+        expect(actionForMessageType("ArohaCancel")).toBe("cancel");
+    });
+    it("maps ArohaDelegate to delegate", () => {
+        expect(actionForMessageType("ArohaDelegate")).toBe("delegate");
+    });
+    it("maps ArohaNegotiate to negotiate", () => {
+        expect(actionForMessageType("ArohaNegotiate")).toBe("negotiate");
+    });
+    it("returns null for response/ack types", () => {
+        expect(actionForMessageType("ArohaResponse")).toBeNull();
+        expect(actionForMessageType("ArohaReserveAck")).toBeNull();
+        expect(actionForMessageType("ArohaCommitAck")).toBeNull();
+        expect(actionForMessageType("ArohaError")).toBeNull();
+    });
+});
+describe("checkPermission", () => {
+    it("allows HumanAdmin all actions", () => {
+        const actions = ["query", "reserve", "commit", "cancel", "delegate", "negotiate", "admin"];
+        for (const action of actions) {
+            const result = checkPermission([ArohaRole.HumanAdmin], action);
+            expect(result.allowed).toBe(true);
+        }
+    });
+    it("allows HumanUser to query/reserve/commit/cancel/negotiate but not delegate or admin", () => {
+        expect(checkPermission([ArohaRole.HumanUser], "query").allowed).toBe(true);
+        expect(checkPermission([ArohaRole.HumanUser], "reserve").allowed).toBe(true);
+        expect(checkPermission([ArohaRole.HumanUser], "delegate").allowed).toBe(false);
+        expect(checkPermission([ArohaRole.HumanUser], "admin").allowed).toBe(false);
+    });
+    it("allows HumanReadonly only query", () => {
+        expect(checkPermission([ArohaRole.HumanReadonly], "query").allowed).toBe(true);
+        expect(checkPermission([ArohaRole.HumanReadonly], "reserve").allowed).toBe(false);
+    });
+    it("denies AgentProvider all actions", () => {
+        expect(checkPermission([ArohaRole.AgentProvider], "query").allowed).toBe(false);
+    });
+    it("allows AgentOrchestrator to delegate", () => {
+        expect(checkPermission([ArohaRole.AgentOrchestrator], "delegate").allowed).toBe(true);
+    });
+    it("returns false with no roles", () => {
+        const result = checkPermission([], "query");
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toMatch(/No roles/);
+    });
+    it("unions permissions across multiple roles", () => {
+        // HumanReadonly (query only) + AgentOrchestrator (query+reserve+..+delegate) → delegate allowed
+        const result = checkPermission([ArohaRole.HumanReadonly, ArohaRole.AgentOrchestrator], "delegate");
+        expect(result.allowed).toBe(true);
+    });
+    it("includes role list in result", () => {
+        const result = checkPermission([ArohaRole.HumanUser], "query");
+        expect(result.roles).toContain(ArohaRole.HumanUser);
+    });
+});
+describe("ArohaSpendingMandate action mapping", () => {
+    it("maps ArohaSpendingMandate to mandate", () => {
+        expect(actionForMessageType("ArohaSpendingMandate")).toBe("mandate");
+    });
+    it("ArohaSatisfactionSignal returns null (private signal, no RBAC)", () => {
+        expect(actionForMessageType("ArohaSatisfactionSignal")).toBeNull();
+    });
+});
+describe("mandate action permissions", () => {
+    it("allows HumanAdmin to issue mandates", () => {
+        expect(checkPermission([ArohaRole.HumanAdmin], "mandate").allowed).toBe(true);
+    });
+    it("allows HumanUser to issue mandates", () => {
+        expect(checkPermission([ArohaRole.HumanUser], "mandate").allowed).toBe(true);
+    });
+    it("allows AgentOrchestrator to issue mandates", () => {
+        expect(checkPermission([ArohaRole.AgentOrchestrator], "mandate").allowed).toBe(true);
+    });
+    it("denies HumanReadonly from issuing mandates", () => {
+        expect(checkPermission([ArohaRole.HumanReadonly], "mandate").allowed).toBe(false);
+    });
+    it("denies AgentObserver from issuing mandates", () => {
+        expect(checkPermission([ArohaRole.AgentObserver], "mandate").allowed).toBe(false);
+    });
+    it("denies AgentProvider from issuing mandates", () => {
+        expect(checkPermission([ArohaRole.AgentProvider], "mandate").allowed).toBe(false);
+    });
+});
+//# sourceMappingURL=rbac.test.js.map

package/dist/rbac.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.test.js","sourceRoot":"","sources":["../src/rbac.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAA4B,MAAM,WAAW,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1D,MAAM,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,CAAU,CAAC;QACpG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/E,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,gGAAgG;QAChG,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,iBAAiB,CAAC,EAAE,UAAU,CAAC,CAAC;QACnG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Aroha Protocol — Human Credential Registry
+ *
+ * Stores signed HumanCredentials so that any agent in the network can
+ * verify a human user's identity and roles by credential ID, without
+ * requiring the full credential token to be re-sent on every message.
+ *
+ * Flow:
+ *   1. Personal Agent issues a HumanCredential (issueHumanCredential)
+ *   2. Personal Agent registers it in the registry  (CredentialRegistry.register)
+ *   3. Human sends a Aroha message with credentialId in the body
+ *   4. Provider agent looks up the credential (CredentialRegistry.resolve)
+ *   5. Provider verifies the stored credential's signature and checks roles
+ *
+ * The registry is exposed as HTTP endpoints by ArohaServer when
+ * ArohaServerOptions.credentialRegistry is set:
+ *
+ *   POST   /aroha/credentials          — register (verifies sig before storing)
+ *   GET    /aroha/credentials/:id      — resolve by ID (public)
+ *   DELETE /aroha/credentials/:id      — revoke (requires issuer proof header)
+ *
+ * Remote agents use CredentialRegistryClient to call these endpoints.
+ */
+import { type HumanCredential } from "./types.js";
+export interface CredentialStore {
+    set(id: string, credential: HumanCredential): Promise<void> | void;
+    get(id: string): Promise<HumanCredential | undefined> | HumanCredential | undefined;
+    delete(id: string): Promise<boolean> | boolean;
+    values(): AsyncIterable<HumanCredential> | Iterable<HumanCredential>;
+}
+export declare class MapCredentialStore implements CredentialStore {
+    private readonly store;
+    set(id: string, credential: HumanCredential): void;
+    get(id: string): HumanCredential | undefined;
+    delete(id: string): boolean;
+    values(): Iterable<HumanCredential>;
+    get size(): number;
+}
+export declare class CredentialRegistry {
+    private readonly store;
+    constructor(store?: CredentialStore);
+    /**
+     * Register a credential after verifying its Ed25519 signature.
+     *
+     * @param credential     The credential to store
+     * @param issuerPublicKey  Ed25519 public key of credential.issuerDID (32 bytes)
+     * @returns `true` if stored successfully, `false` if signature is invalid
+     */
+    register(credential: HumanCredential, issuerPublicKey: Uint8Array): Promise<boolean>;
+    /**
+     * Register a credential that has already been verified.
+     * Use this when the calling code has already confirmed validity
+     * (e.g., the issuing agent registering its own credential).
+     */
+    registerTrusted(credential: HumanCredential): void;
+    /**
+     * Resolve a credential by ID.
+     * Returns null if not found, or if the credential has expired (auto-evicts).
+     */
+    resolve(credentialId: string): HumanCredential | null;
+    /**
+     * Revoke a credential by ID.
+     * @returns `true` if it existed and was removed, `false` if not found
+     */
+    revoke(credentialId: string): boolean;
+    /**
+     * List all active (non-expired) credentials for a given userId.
+     */
+    listForUser(userId: string): HumanCredential[];
+    /** Total number of stored credentials (including potentially expired ones). */
+    get size(): number;
+    /**
+     * Evict all expired credentials. Called periodically to free memory.
+     * Returns the number of credentials evicted.
+     */
+    evictExpired(): number;
+}
+/**
+ * HTTP client for remote credential registry lookups.
+ *
+ * Any agent can use this to query the registry hosted by a Personal Agent
+ * (or any ArohaServer with credentialRegistry configured).
+ */
+export declare class CredentialRegistryClient {
+    private readonly baseUrl;
+    constructor(baseUrl: string);
+    /**
+     * Register a credential in the remote registry.
+     * The registry will verify the credential's signature before storing.
+     */
+    register(credential: HumanCredential): Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
+    /**
+     * Resolve a credential by ID from the remote registry.
+     * Returns null if not found or expired.
+     */
+    resolve(credentialId: string): Promise<HumanCredential | null>;
+    /**
+     * Revoke a credential.
+     *
+     * The caller must provide a revocation proof: a base64url Ed25519 signature
+     * over `{credentialId, action:"revoke"}` using the issuer's private key.
+     * This is checked server-side before deletion.
+     */
+    revoke(credentialId: string, revokeProof: string): Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
+    /**
+     * List all active credentials for a userId.
+     */
+    listForUser(userId: string): Promise<HumanCredential[]>;
+}
+/**
+ * Build a revocation proof to pass to CredentialRegistryClient.revoke().
+ * Signs `{action:"revoke",credentialId}` with the issuer's private key.
+ */
+export declare function buildRevokeProof(credentialId: string, issuerPrivateKey: Uint8Array): Promise<string>;
+/**
+ * Verify a revocation proof server-side.
+ */
+export declare function verifyRevokeProof(credentialId: string, proof: string, issuerPublicKey: Uint8Array): Promise<boolean>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAOlD,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACnE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,GAAG,eAAe,GAAG,SAAS,CAAC;IACpF,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC/C,MAAM,IAAI,aAAa,CAAC,eAAe,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;CACtE;AAID,qBAAa,kBAAmB,YAAW,eAAe;IACxD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsC;IAE5D,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,IAAI;IAIlD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAI5C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAI3B,MAAM,IAAI,QAAQ,CAAC,eAAe,CAAC;IAInC,IAAI,IAAI,IAAI,MAAM,CAA4B;CAC/C;AAID,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;gBAE5B,KAAK,GAAE,eAA0C;IAI7D;;;;;;OAMG;IACG,QAAQ,CAAC,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAS1F;;;;OAIG;IACH,eAAe,CAAC,UAAU,EAAE,eAAe,GAAG,IAAI;IAIlD;;;OAGG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAYrD;;;OAGG;IACH,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAMrC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE;IAY9C,+EAA+E;IAC/E,IAAI,IAAI,IAAI,MAAM,CAGjB;IAED;;;OAGG;IACH,YAAY,IAAI,MAAM;CAYvB;AAID;;;;;GAKG;AACH,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,MAAM;IAE5C;;;OAGG;IACG,QAAQ,CAAC,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAWtF;;;OAGG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAMpE;;;;;;OAMG;IACG,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAUlG;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;CAK9D;AAID;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,UAAU,GAC3B,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,UAAU,GAC1B,OAAO,CAAC,OAAO,CAAC,CASlB"}

package/dist/registry.js

@@ -0,0 +1,227 @@
+/**
+ * Aroha Protocol — Human Credential Registry
+ *
+ * Stores signed HumanCredentials so that any agent in the network can
+ * verify a human user's identity and roles by credential ID, without
+ * requiring the full credential token to be re-sent on every message.
+ *
+ * Flow:
+ *   1. Personal Agent issues a HumanCredential (issueHumanCredential)
+ *   2. Personal Agent registers it in the registry  (CredentialRegistry.register)
+ *   3. Human sends a Aroha message with credentialId in the body
+ *   4. Provider agent looks up the credential (CredentialRegistry.resolve)
+ *   5. Provider verifies the stored credential's signature and checks roles
+ *
+ * The registry is exposed as HTTP endpoints by ArohaServer when
+ * ArohaServerOptions.credentialRegistry is set:
+ *
+ *   POST   /aroha/credentials          — register (verifies sig before storing)
+ *   GET    /aroha/credentials/:id      — resolve by ID (public)
+ *   DELETE /aroha/credentials/:id      — revoke (requires issuer proof header)
+ *
+ * Remote agents use CredentialRegistryClient to call these endpoints.
+ */
+import * as ed from "@noble/ed25519";
+import { sha512 } from "@noble/hashes/sha512";
+import { verifyHumanCredential } from "./credentials.js";
+ed.etc.sha512Sync = (...m) => sha512(...m);
+// ─── Default in-process store ─────────────────────────────────────────────────
+export class MapCredentialStore {
+    store = new Map();
+    set(id, credential) {
+        this.store.set(id, credential);
+    }
+    get(id) {
+        return this.store.get(id);
+    }
+    delete(id) {
+        return this.store.delete(id);
+    }
+    values() {
+        return this.store.values();
+    }
+    get size() { return this.store.size; }
+}
+// ─── Registry ─────────────────────────────────────────────────────────────────
+export class CredentialRegistry {
+    store;
+    constructor(store = new MapCredentialStore()) {
+        this.store = store;
+    }
+    /**
+     * Register a credential after verifying its Ed25519 signature.
+     *
+     * @param credential     The credential to store
+     * @param issuerPublicKey  Ed25519 public key of credential.issuerDID (32 bytes)
+     * @returns `true` if stored successfully, `false` if signature is invalid
+     */
+    async register(credential, issuerPublicKey) {
+        const { serializeCredential } = await import("./credentials.js");
+        const token = serializeCredential(credential);
+        const result = await verifyHumanCredential(token, issuerPublicKey);
+        if (!result.valid)
+            return false;
+        await this.store.set(credential.credentialId, credential);
+        return true;
+    }
+    /**
+     * Register a credential that has already been verified.
+     * Use this when the calling code has already confirmed validity
+     * (e.g., the issuing agent registering its own credential).
+     */
+    registerTrusted(credential) {
+        this.store.set(credential.credentialId, credential);
+    }
+    /**
+     * Resolve a credential by ID.
+     * Returns null if not found, or if the credential has expired (auto-evicts).
+     */
+    resolve(credentialId) {
+        const cred = this.store.get(credentialId);
+        if (!cred)
+            return null;
+        if (cred instanceof Promise)
+            return null; // async store: use async resolveAsync instead
+        const credTyped = cred;
+        if (new Date(credTyped.expiresAt) < new Date()) {
+            this.store.delete(credentialId); // evict expired
+            return null;
+        }
+        return credTyped;
+    }
+    /**
+     * Revoke a credential by ID.
+     * @returns `true` if it existed and was removed, `false` if not found
+     */
+    revoke(credentialId) {
+        const result = this.store.delete(credentialId);
+        if (result instanceof Promise)
+            return false;
+        return result;
+    }
+    /**
+     * List all active (non-expired) credentials for a given userId.
+     */
+    listForUser(userId) {
+        const now = new Date();
+        const results = [];
+        const vals = this.store.values();
+        for (const cred of vals) {
+            if (cred.userId === userId && new Date(cred.expiresAt) >= now) {
+                results.push(cred);
+            }
+        }
+        return results;
+    }
+    /** Total number of stored credentials (including potentially expired ones). */
+    get size() {
+        const s = this.store;
+        return s.size ?? 0;
+    }
+    /**
+     * Evict all expired credentials. Called periodically to free memory.
+     * Returns the number of credentials evicted.
+     */
+    evictExpired() {
+        const now = new Date();
+        let count = 0;
+        const vals = this.store.values();
+        for (const cred of vals) {
+            if (new Date(cred.expiresAt) < now) {
+                this.store.delete(cred.credentialId);
+                count++;
+            }
+        }
+        return count;
+    }
+}
+// ─── HTTP Client ───────────────────────────────────────────────────────────────
+/**
+ * HTTP client for remote credential registry lookups.
+ *
+ * Any agent can use this to query the registry hosted by a Personal Agent
+ * (or any ArohaServer with credentialRegistry configured).
+ */
+export class CredentialRegistryClient {
+    baseUrl;
+    constructor(baseUrl) {
+        this.baseUrl = baseUrl;
+    }
+    /**
+     * Register a credential in the remote registry.
+     * The registry will verify the credential's signature before storing.
+     */
+    async register(credential) {
+        const res = await fetch(`${this.baseUrl}/aroha/credentials`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(credential),
+        });
+        if (res.ok)
+            return { ok: true };
+        const body = await res.json().catch(() => ({}));
+        return { ok: false, reason: String(body.error ?? res.statusText) };
+    }
+    /**
+     * Resolve a credential by ID from the remote registry.
+     * Returns null if not found or expired.
+     */
+    async resolve(credentialId) {
+        const res = await fetch(`${this.baseUrl}/aroha/credentials/${encodeURIComponent(credentialId)}`);
+        if (!res.ok)
+            return null;
+        return res.json();
+    }
+    /**
+     * Revoke a credential.
+     *
+     * The caller must provide a revocation proof: a base64url Ed25519 signature
+     * over `{credentialId, action:"revoke"}` using the issuer's private key.
+     * This is checked server-side before deletion.
+     */
+    async revoke(credentialId, revokeProof) {
+        const res = await fetch(`${this.baseUrl}/aroha/credentials/${encodeURIComponent(credentialId)}`, {
+            method: "DELETE",
+            headers: { "X-Revoke-Proof": revokeProof },
+        });
+        if (res.ok)
+            return { ok: true };
+        const body = await res.json().catch(() => ({}));
+        return { ok: false, reason: String(body.error ?? res.statusText) };
+    }
+    /**
+     * List all active credentials for a userId.
+     */
+    async listForUser(userId) {
+        const res = await fetch(`${this.baseUrl}/aroha/credentials?userId=${encodeURIComponent(userId)}`);
+        if (!res.ok)
+            return [];
+        return res.json();
+    }
+}
+// ─── Revoke proof helpers ──────────────────────────────────────────────────────
+/**
+ * Build a revocation proof to pass to CredentialRegistryClient.revoke().
+ * Signs `{action:"revoke",credentialId}` with the issuer's private key.
+ */
+export async function buildRevokeProof(credentialId, issuerPrivateKey) {
+    const payload = JSON.stringify({ action: "revoke", credentialId });
+    const bytes = new TextEncoder().encode(payload);
+    const sig = await ed.signAsync(bytes, issuerPrivateKey);
+    return Buffer.from(sig).toString("base64url");
+}
+/**
+ * Verify a revocation proof server-side.
+ */
+export async function verifyRevokeProof(credentialId, proof, issuerPublicKey) {
+    try {
+        const payload = JSON.stringify({ action: "revoke", credentialId });
+        const bytes = new TextEncoder().encode(payload);
+        const sig = Buffer.from(proof, "base64url");
+        return await ed.verifyAsync(sig, bytes, issuerPublicKey);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAA4B,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAWtE,iFAAiF;AAEjF,MAAM,OAAO,kBAAkB;IACZ,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE5D,GAAG,CAAC,EAAU,EAAE,UAA2B;QACzC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,IAAI,KAAa,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;CAC/C;AAED,iFAAiF;AAEjF,MAAM,OAAO,kBAAkB;IACZ,KAAK,CAAkB;IAExC,YAAY,QAAyB,IAAI,kBAAkB,EAAE;QAC3D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,UAA2B,EAAE,eAA2B;QACrE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,UAA2B;QACzC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,YAAoB;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,IAAI,YAAY,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,8CAA8C;QACxF,MAAM,SAAS,GAAG,IAAuB,CAAC;QAC1C,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAoB;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,MAAM,YAAY,OAAO;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,MAAiB,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAc;QACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,IAAiC,EAAE,CAAC;YACrD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC9D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,+EAA+E;IAC/E,IAAI,IAAI;QACN,MAAM,CAAC,GAAG,IAAI,CAAC,KAA2B,CAAC;QAC3C,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,YAAY;QACV,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,IAAiC,EAAE,CAAC;YACrD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC;gBACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACrC,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,kFAAkF;AAElF;;;;;GAKG;AACH,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAEhD;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,UAA2B;QACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,oBAAoB,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;SACjC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA4B,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,sBAAsB,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,GAAG,CAAC,IAAI,EAA8B,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,YAAoB,EAAE,WAAmB;QACpD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,sBAAsB,kBAAkB,CAAC,YAAY,CAAC,EAAE,EAAE;YAC/F,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE;SAC3C,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA4B,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,6BAA6B,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,IAAI,EAAgC,CAAC;IAClD,CAAC;CACF;AAED,kFAAkF;AAElF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAAoB,EACpB,gBAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,YAAoB,EACpB,KAAa,EACb,eAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC5C,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/registry.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=registry.test.d.ts.map

package/dist/registry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.test.d.ts","sourceRoot":"","sources":["../src/registry.test.ts"],"names":[],"mappings":""}

package/dist/registry.test.js

@@ -0,0 +1,142 @@
+import { describe, it, expect } from "vitest";
+import * as ed from "@noble/ed25519";
+import { sha512 } from "@noble/hashes/sha512";
+import { CredentialRegistry, buildRevokeProof, verifyRevokeProof } from "./registry.js";
+import { issueHumanCredential } from "./credentials.js";
+import { ArohaRole } from "./types.js";
+ed.etc.sha512Sync = (...m) => sha512(...m);
+async function makeIssuer() {
+    const priv = ed.utils.randomPrivateKey();
+    const pub = await ed.getPublicKeyAsync(priv);
+    return { priv, pub, did: "did:aroha:issuer" };
+}
+async function makeCred(issuer, userId = "user-1") {
+    return issueHumanCredential(userId, [ArohaRole.HumanUser], issuer.did, issuer.priv);
+}
+describe("CredentialRegistry", () => {
+    it("registers and resolves a valid credential", async () => {
+        const issuer = await makeIssuer();
+        const cred = await makeCred(issuer);
+        const registry = new CredentialRegistry();
+        const ok = await registry.register(cred, issuer.pub);
+        expect(ok).toBe(true);
+        const resolved = registry.resolve(cred.credentialId);
+        expect(resolved).not.toBeNull();
+        expect(resolved?.userId).toBe("user-1");
+    });
+    it("rejects registration with wrong issuer key", async () => {
+        const issuer = await makeIssuer();
+        const wrongIssuer = await makeIssuer();
+        const cred = await makeCred(issuer);
+        const registry = new CredentialRegistry();
+        const ok = await registry.register(cred, wrongIssuer.pub);
+        expect(ok).toBe(false);
+        expect(registry.resolve(cred.credentialId)).toBeNull();
+    });
+    it("registerTrusted bypasses signature check", async () => {
+        const issuer = await makeIssuer();
+        const cred = await makeCred(issuer);
+        const registry = new CredentialRegistry();
+        registry.registerTrusted(cred);
+        expect(registry.resolve(cred.credentialId)).not.toBeNull();
+    });
+    it("revokes a credential", async () => {
+        const issuer = await makeIssuer();
+        const cred = await makeCred(issuer);
+        const registry = new CredentialRegistry();
+        registry.registerTrusted(cred);
+        expect(registry.resolve(cred.credentialId)).not.toBeNull();
+        const removed = registry.revoke(cred.credentialId);
+        expect(removed).toBe(true);
+        expect(registry.resolve(cred.credentialId)).toBeNull();
+    });
+    it("returns false when revoking a non-existent credential", () => {
+        const registry = new CredentialRegistry();
+        expect(registry.revoke("nonexistent")).toBe(false);
+    });
+    it("listForUser returns credentials for that user", async () => {
+        const issuer = await makeIssuer();
+        const cred1 = await makeCred(issuer, "alice");
+        const cred2 = await makeCred(issuer, "bob");
+        const registry = new CredentialRegistry();
+        registry.registerTrusted(cred1);
+        registry.registerTrusted(cred2);
+        const aliceList = registry.listForUser("alice");
+        expect(aliceList).toHaveLength(1);
+        expect(aliceList[0].userId).toBe("alice");
+    });
+    it("evicts expired credentials", async () => {
+        const issuer = await makeIssuer();
+        const expired = await issueHumanCredential("user-exp", [ArohaRole.HumanUser], issuer.did, issuer.priv, -1000);
+        const registry = new CredentialRegistry();
+        registry.registerTrusted(expired);
+        const count = registry.evictExpired();
+        expect(count).toBe(1);
+        expect(registry.size).toBe(0);
+    });
+    it("returns null on resolve of expired credential (auto-evict)", async () => {
+        const issuer = await makeIssuer();
+        const expired = await issueHumanCredential("user-exp", [ArohaRole.HumanUser], issuer.did, issuer.priv, -1000);
+        const registry = new CredentialRegistry();
+        registry.registerTrusted(expired);
+        expect(registry.resolve(expired.credentialId)).toBeNull();
+        expect(registry.size).toBe(0);
+    });
+});
+describe("buildRevokeProof / verifyRevokeProof", () => {
+    it("builds a proof that verifies", async () => {
+        const issuer = await makeIssuer();
+        const proof = await buildRevokeProof("cred-123", issuer.priv);
+        const valid = await verifyRevokeProof("cred-123", proof, issuer.pub);
+        expect(valid).toBe(true);
+    });
+    it("fails verification with wrong public key", async () => {
+        const issuer = await makeIssuer();
+        const other = await makeIssuer();
+        const proof = await buildRevokeProof("cred-456", issuer.priv);
+        const valid = await verifyRevokeProof("cred-456", proof, other.pub);
+        expect(valid).toBe(false);
+    });
+    it("fails verification with different credentialId", async () => {
+        const issuer = await makeIssuer();
+        const proof = await buildRevokeProof("cred-A", issuer.priv);
+        const valid = await verifyRevokeProof("cred-B", proof, issuer.pub);
+        expect(valid).toBe(false);
+    });
+});
+describe("CredentialStore interface", () => {
+    it("MapCredentialStore is exported and usable", async () => {
+        const { MapCredentialStore } = await import("./registry.js");
+        const store = new MapCredentialStore();
+        const cred = {
+            credentialId: "test-id",
+            userId: "user-1",
+            roles: [ArohaRole.HumanUser],
+            issuedAt: new Date().toISOString(),
+            expiresAt: new Date(Date.now() + 3600_000).toISOString(),
+            issuerDID: "did:aroha:issuer",
+            signature: "dummy",
+        };
+        await store.set(cred.credentialId, cred);
+        expect(await store.get(cred.credentialId)).toEqual(cred);
+        await store.delete(cred.credentialId);
+        expect(await store.get(cred.credentialId)).toBeUndefined();
+    });
+    it("CredentialRegistry accepts a custom store", async () => {
+        const { MapCredentialStore, CredentialRegistry } = await import("./registry.js");
+        const store = new MapCredentialStore();
+        const reg = new CredentialRegistry(store);
+        const cred = {
+            credentialId: "custom-store-id",
+            userId: "user-2",
+            roles: [ArohaRole.HumanUser],
+            issuedAt: new Date().toISOString(),
+            expiresAt: new Date(Date.now() + 3600_000).toISOString(),
+            issuerDID: "did:aroha:issuer",
+            signature: "dummy",
+        };
+        reg.registerTrusted(cred);
+        expect(reg.resolve("custom-store-id")).toEqual(cred);
+    });
+});
+//# sourceMappingURL=registry.test.js.map

package/dist/registry.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.test.js","sourceRoot":"","sources":["../src/registry.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAuB,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAA4B,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAEtE,KAAK,UAAU,UAAU;IACvB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAA8C,EAAE,MAAM,GAAG,QAAQ;IACvF,OAAO,oBAAoB,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAE1C,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,MAAM,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAE1C,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAE1C,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAE1C,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAE3D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAC1C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAE1C,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAEhC,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAC1C,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAElC,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAC1C,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAElC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAIH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAoB;YAC5B,YAAY,EAAE,SAAS;YACvB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC;YAC5B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;YACxD,SAAS,EAAE,kBAAkB;YAC7B,SAAS,EAAE,OAAO;SACnB,CAAC;QACF,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAoB;YAC5B,YAAY,EAAE,iBAAiB;YAC/B,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC;YAC5B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;YACxD,SAAS,EAAE,kBAAkB;YAC7B,SAAS,EAAE,OAAO;SACnB,CAAC;QACF,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}